SSHUserPrivateKey.getPassphrase is documented to return null if the private key is not protected by passphrase. Yet the constructor of BasicSSHUserPrivateKey does not check for an empty passphrase, and Secret.fromString never returns null, so getPassphrase returns a non-null result even if none was specified (in this case .getPassphrase().getPlainText().isEmpty()).